topic Re: PA DHCP log search in General Topics

PA DHCP log search

jdprovine — Thu, 02 Mar 2017 16:51:28 GMT

Is there a way to do a specific search for and IP address or mac address in the DHCP logs? I can find and get into the logs but I have to manually look through all the logs to find what I need

Re: PA DHCP log search

BPry — Thu, 02 Mar 2017 17:27:41 GMT

There is no way to look specify the DHCP logs through the GUI, and therefore you can only actually scroll through them like what you are doing now.

You can do it through the cli by doing a show dhcp server lease all | match IP/MAC and it'll give you the result that you are looking for; alternatively you can all sourt by the specific interface instead of specifying all, but since your piping the output it isn't going to matter much what you put it so I usually just leave all as the default

Re: PA DHCP log search

jdprovine — Thu, 02 Mar 2017 17:31:15 GMT

yeah I was only doing it through the cli and doing a less mp-log pan_dhcp.log I just didn't know what the syntax was to search for a specific mac or IP address in the logs

Re: PA DHCP log search

jdprovine — Thu, 02 Mar 2017 17:35:06 GMT

Thats was good but it showed me who it was reserved too but not if the device actually has the IP currently

Re: PA DHCP log search

BPry — Thu, 02 Mar 2017 18:52:44 GMT

I'm not sure that this information is actively tracked on the PA; I really only run DHCP on small remote offices though so I'm not all that positive if this is correct, but it appears that my committed are pingable, my expired are not, and the reserved IPs obviously in use if they are assigned.

Re: PA DHCP log search

jdprovine — Thu, 02 Mar 2017 19:12:38 GMT

Some of my committed and my reserved are pingable and in use. Some of them show lease times and some do not but the ones that do not show lease times are in use and active

Re: PA DHCP log search

jdprovine — Mon, 13 Mar 2017 19:48:22 GMT

I found the the right syntax to search the DHCP logs on the PA

grep mp-log pan_dhcpd.log pattern 192.xxx.xxx.xxx

Re: PA DHCP log search

jvalentine — Mon, 13 Mar 2017 19:55:07 GMT

( subtype eq dhcp ) and ( description contains '34:12' )

( subtype eq dhcp ) and ( description contains '10.1.1.2' )